Hi,
the attached patches upstream functionality that mod_lookup_identity has
been using for a while, but which we couldn't push to master due to the
pending sbus changes. Now that these are accepted, it's time to merge
the DBus methods themselves. Previously, mod_lookup_identity relied on a
private branch with quite a bit of ad-hoc code.
Please note that when the work in progress to expose users, groups and
domains is merged as well, this interface will become obsolete in favor
of the objects. But we shouldn't let a released version of
mod_lookup_identity rely on unreleased sssd code any longer. Moreover,
all patches except the last one will be used even later on and there's
no fixed timeline on converting mod_lookup_identity.
[PATCH 1/6] SBUS: two trivial style fixes
SSIA
[PATCH 2/6] SBUS: Add a convenience function
Adds a convenience function that constructs a DBusError internally and
as such can be used to mark an sbus request as failed without having
to create a DBusError instance by the caller. The error message must be
either allocated on top of dbus_req or a constant, DBus itself doesn't
copy the error message! This is reflected in the doxygen docstring.
[PATCH 3/6] IFP: Add utility functions
Adds a number of utility functions, most importanly ifp_req_create().
The ifp_req is a structure that will be passed along with the ifp
request and contains the sbus request and some ifp-specific data, like
caller ID or the responder context.
[PATCH 4/6] IFP: use a list of allowed_uids for authentication
Similar to the PAC responder, the InfoPipe uses a list of UIDs that are
allowed to communicate with the IFP responder.
[PATCH 5/6] IFP: Initialize negative cache timeout
In order to avoid hitting the back end with repetitive requests, the
InfoPipe responder needs a negative cache, too. This patch follows the
convention set by other responders, where the negative cache timeouts are
read from the [nss] section. This is not ideal, however, and ticket #2318
tracks moving the configuration to the [ifp] section primarily.
The timeout is also a separate parameter in the NSS context. We should
consider moving it to the negcache context instead (#2317).
[PATCH 6/6] IFP: Add GetUserAttrs call
Adds a DBus method that allows the caller to retrieve attributes of a
user. The synopsis of the call is as follows:
<method name="GetUserAttr">
<arg type="s" name="user" direction="in"/>
<arg type="as" name="attr" direction="in"/>
<arg type="a{sv}" name="values"
direction="out"/>
</method>
The return value is an array (one attribute per array member) of
dictionaries. The key of the dictionary is the attribute name, the value
is a variant containing the attribute values as strings.
If an attribute does not exist or is not permitted to be read, no error
is returned. If the users does not exist, the method returns an error.
In future patches this function will be marked as obsolete in favor of
object-oriented approach.
ifp_user_get_attr_unpack_msg is a separate function to allow extending
it in a later patch.
The function to check the cache validity duplicates quite a bit of code
with the NSS responder. The refactoring would be nice to get done along
with #843. I have a patch in my private branch, but it's not complete,
sorry.
Show replies by thread